Apache Filled with POST Requests from Server IP

dswimr615

• March 17, 2020 17:30

We just experienced some strange behavior on one of our servers, where Apache's status page was filled with POST requests to the main (/) page of a single website. The source IP for every request, however, is/was the main IP for the server (see below image, private information blurred out) so it's not an attack, unless the attack was somehow masked to be from the server's main IP (could that happen?). Access logs show the same thing and don't reveal any more information. I couldn't find anything online or in these forums about a related incident. Does anyone have any ideas as to what might have happened or how to reveal more info if this happens again? Restarting Apache cleared all of the requests and no more spawned afterward.

• 

  HostNoc

  • March 18, 2020 08:03

  Hello @dswimr615 The reason of this issue could be that any code of site could be executing the post in multiple attempts, or a contact form is being abused on a site. I would suggest checking the site's codes, check the /etc/hosts files, the IP configuration, and also I would highly suggest running the cPanel stable version update and review EaseApache4 settings. Regards,

  0
• 

  cPanelLauren

  • March 18, 2020 14:17

  Are other requests being generated from the actual source IP address? Meaning, all requests to your server are not being shown as originating from your server's IP address correct?

  0
• 

  dswimr615

  • March 18, 2020 17:43

  Hello @dswimr615 The reason of this issue could be that any code of site could be executing the post in multiple attempts, or a contact form is being abused on a site. I would suggest checking the site's codes, check the /etc/hosts files, the IP configuration, and also I would highly suggest running the cPanel stable version update and review EaseApache4 settings. Regards,

  
  That's a good idea, I'll look around for anything that could be sending locally.

  Are other requests being generated from the actual source IP address? Meaning, all requests to your server are not being shown as originating from your server's IP address correct?

  
  Hey Lauren! That is correct, other traffic shows normally/from a variety of IPs. It was just that one burst of POST requests without any apparent target and strangely showing as from the server's main IP.

  0
• 

  cPanelLauren

  • March 18, 2020 21:13

  Hey Lauren! That is correct, other traffic shows normally/from a variety of IPs. It was just that one burst of POST requests without any apparent target and strangely showing as from the server's main IP.

  
  In that case, I'd lean more towards what @HostNoc was suggesting.

  0

Please sign in to leave a comment.